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-Abstract- 

I  _ 


When  designing  an  explosives  facility,  French  manufacturers  must  refer  to  the  basic 
principle  of  French  safety  regulation,  which  states : 

"Buildings  must  be  designed  and  built  in  a  manner  such  that  any  accidental  explosion  shall 
not  generate  a  major  risk  for  persons  other  than  those  who,  due  to  their  work,  must  remain 
exposed  to  the  possible  effects  of  a  potential  accident". 

This  paper  shows  the  concrete  application  of  this  principle  when  designing  a  missile 
warhead  environmental  test  facility,  setting  the  safety  organisation,  stipulating  the 
operating  rules  and  justifying  the  options  and  decisions  to  the  Official  French  Agencies. 
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I.  Introduction 


The  major  principles  for  explosive  safety  are  well-known  to  the  international  technical 
community.  In  each  country,  they  are  subject  to  the  rules  and  regulations  in  force  which 
mainly  differ  in  form  but  are  similar  as  regards  their  technical  content. 


In  France,  however,  the  situation  may  be  considered  as  rather  particular.  Indeed,  a  national 
regulation  which  is  applicable  to  the  entire  French  explosive  products  and  items  industry 
defines  the  principles,  the  resulting  technical  arrangements  and  the  conditions  according  to 
which  manufacturers  must  demonstrate  the  validity  of  the  steps  taken  to  the 
administration  ensuring  the  safety  of  the  personnel  and  the  environment. 


At  the  23rd,  E.S.S.,  I  spoke  on  this  regulation,  and  its  application  by  MATRA  DEFENSE  in 
the  context  of  a  MISTRAL  missile  production  facility.  In  particular  I  indicated  the  means 
installed  to  control  the  safety  of  the  establishment  and  the  environment. 

As  MATRA  DEFENSE  develops  and  manufactures  missile  systems,  we  have  designed  and 
constructed  a  new  workshop  intended  for  environmental  testing  of  missile  components  and 
munitions.  This  installation  is  a  good  example  of  the  method  chosen  by  MATRA  DEFENSE 
to  provide  the  best  safety  level  for  the  operators  as  well  as  for  neighboring  installations,  in 
accordance  with  criteria  fixed  by  the  French  regulation. 
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II.  Explosive  safety  rules 


Before  starting  studies  on  a  new  munitions  test  facility,  it  is  appropriate  to  outline  the  basic 
principles  the  designer  must  adhere  to  in  preparing  his  study. 


In  the  United  States  the  principle  of  facility  safety  is  illustrated  by  a  paragraph  of  the  DOD 
document :  Ammunition  and  explosives  safety  standards  6055-9 : 

"Construction  features  and  location  are  important  safety  considerations  in  planning 
facilities  that  are  to  be  P.E.S.,  or  exposed  to  the  damaging  effects  of  potential  explosion  (that 
is  E.S.).  The  effects  of  potential  explosions  may  be  altered  significantly  by  construction 
features  that  limit  the  amount  of  explosives  involved,  attenuate  resultant  blast 
overpressure  or  thermal  radiation,  and  reduce  the  quantity  and  range  of  hazardous 
fragments  and  debris.  Proper  location  of  exposed  sites  in  relation  to  P.E.S.  ensures  against 
unacceptable  damage  and  injuries  in  event  of  an  accident". 


In  France,  the  applicable  regulation  (Decree  N°  79-846)  stipulates : 

"Buildings  must  be  designed  and  built  in  a  manner  such  that  any  accidental  explosion  shall 
not  generate  a  major  risk  for  persons  other  than  those  who,  due  to  their  work,  must  remain 
exposed  to  the  possible  effects  of  a  potential  accident". 


These  general  requirements  are  completed  by  the  Zi/Pj/ak  formula  which  establishes 
maximum  risk  exposure  conditions.  Using  this  approach,  operator  safety  is  evaluated 
according  to  the  following  criteria : 


-  Hazard  zones  (Zi),  representing  the  consequences  of  an  accident  exposing  personnel  to 
overpressures,  fragment  projections,  and  thermal  effects : 


Zi 

PERSONAL  INJURY 

PROPERTY  DAMAGE 

Zl 

LETHAL  INJURIES  IN  MORE  THAN 

50%  OF  CASES 

VERY  SEVERE  DAMAGE 

Z2 

SERIOUS  INJURIES 

WHICH  MAY  BE  LETHAL 

SEVERE  DAMAGE 

Z3 

INJURIES 

MEDIUM  AND  SLIGHT  DAMAGE 

Z4 

POSSIBILITY  OF  INJURIES 

SLIGHT  DAMAGE 

Z5 

VERY  LOW  POSSIBILITY  OF 

SLIGHT  INJURIES 

VERY  SLIGHT  DAMAGE 
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-Probability  of  an  explosive  accident  (Pj).  This  point  is  determined  by  an  analysis  of 
operations  carried  out,  that  is,  stimuli  liable  to  affect  the  munitions,  the  sensitivity  of  the 
munitions  to  these  stimuli  and  the  preventive  measures  to  be  implemented. 


Pj 

LEVEL 

EXAMPLES 

PI 

EXTREMELY  RARE 

STORAGE  AND  HANDLING 

P2 

VERY  RARE 

FABRICATION  OPERATIONS-PACKING 

P3 

RARE 

MACHINING  OF  SENSITIVE,  ENERGETIC 
MATERIAL, 

COMPLETE  ROUND  TEST  OPERATIONS 

P4 

RATHER  FREQUENT 

OPERATIONS  ON  VERY  SENSITIVE 
MATERIALS,  PRODUCTION  OF  PRIMARY 
EXPLOSIVES 

P5 

FREQUENT 

MIXING,  COMPRESSION  OF  PRIMARY 
EXPLOSIVES 
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-  Risk  exposure  :  for  the  facility  under  study-considered  as  risk  donor  or  potential 
explosion  site  (P.E.S),  called  "ao",  the  different  types  of  installations  and  personnel  risk 
receivers  -  or  exposed  sites  (E.S.)  -  are  succinctly  classified  in  three  categories : 


1.  Facilities  inside  the  plant 

ai  Explosive  facilities  having  to  be  located  near  "ao" 
Other  explosive  facilities  and  inner  roads 
a3  Inert  buildings 


2.  Roads  outside  the  plant 

bi  Traffic  <  200  vehicles/day 

bj  Traffic  between  200  and  2000  vehicles/day 

ba  Important  traffic  >  2000  vehicles/day 


3.  Buildings  or  other  places  outside  the  plant 

ci  Uninhabited,  short  presence 

ca  Inhabited  by,  or  with,  plant  personnel  present 

C3  Other  facilities,  houses... 

c*  Public  places :  markets,  schools,  hospitals,  dense  built-up  areas. 
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According  to  the  product  of  Zi  X  Pj,  limits  are  established  for  risk  exposure  to  both 
operators  and  installations.  These  possibilities  are  indicated  in  the  following  table : 


^^^probability 

hazard 

zone 

PI 

P2 

P3 

P4 

P5 

Zl 

ao 

30 

3qW 

aoO™) 

ao***) 

Z2 

3! 

3i 

32 

a2(*> 

31 

ai(x) 

ai(»<) 

a,  b,  C! 

31  b,d 

31 

Z3 

32 

32 

32 

ai 

3i(x) 

33 

Z4 

a,  bi  d 

31  bi  Cl 

3i  bi  Cl 

31 

32  b2  c2 

32  b2C2 

a2 

32 

ai 

33 

33 

Z5 

31  bi  Cl 

31  bi  Cl 

31  bi  Cl 

ai  bi  Cl 

3i  bi  d 

32  b2  C2 

32  b2C2 

32  b2 C2 

32  b2C2 

32  b2C2 

33  b3  C3 

33  b3C3 

33  b3  C3 

32  b3c3 

a3  b3 

NOTE :  (*)  Indicates  that  the  personnel  required  to  operate  the  facility  concerned  shall 

not  be  subjected  for  more  than  10  %  of  their  working  time  to  risks  equalling  to 
those  to  which  they  are  exposed  in  this  installation. 


(**)  Indicates,  that  no  person  shall  be  present  in  the  zone  and  installation 
concerned,  in  application  of  the  requirements  of  Article  27  of  Decree  No.79-846 
of  September  28, 1979. 
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A  minimum  number  of  persons  shall  be  allowed  to  gather  simultaneously  in  zones  Z1  and 
Z2. 


The  number  of  persons  simultaneously  present  throughout  installation  "ao"  exhibiting  a 
probability  of  explosive  accident  greater  than  PI  shall  not  normally  exceed  5. 


Thus,  it  clearly  appears  that  when  environmental  tests,  such  as  climatic,  vibration,  impact 
and  so  on,  are  conducted  in  a  facility,  the  probability  of  an  explosive  accident  will  be  at  least 
P3  and  that  special  measures  should  be  taken  to  protect  operators. 

One  of  the  essential  aspects  of  the  French  regulation  is  that  the  analysis  briefly  described 
must  be  conducted  in  the  form  of  a  safety  study  on  which  the  opinion  of  the  personnel  or  its 
representatives  is  given.  The  study  is  then  submitted  for  approval  to  the  competent 
governmental  authorities. 
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III.  Design  of  the  "Environmental  test”  facility 

To  begin  the  study  for  the  facility,  a  preliminary  3-step  examination  should  be  undertaken  : 

1-  Precisely  defining  needs,  in  other  words,  the  type  of  munitions  concerned,  net 
explosive  quantity  (N.E.Q.)  of  the  maximum  credible  event,  and  the  various 
operations  that  will  be  carried  out.  For  example  :  munitions  with  explosive  charges 
rated  at  15  kg  N.E.Q.  and  climatic  or  mechanical  testing  (impact,  vibration, 
acceleration  tests). 

2-  Defining  facility  characteristics  which  will  ensure  personnel  safety 
environment  and  worktool  protection.  For  this,  the  workshop  must : 

Withstand  the  effects  of  an  accidental  explosion  during  testing ; 

Contain  hazardous  fragments,  and 

Reduce  the  effects  of  such  an  explosion  to  an  acceptable  level  for  the  environment. 

3  -  Defining  the  number  of  rooms  required  •  this  kind  of  installation  necessitates  test 
cells,  a  storage  cell,  a  corridor,  and  a  facility  control  center. 

The  principle  of  limiting  personnel  risk  exposure,  combined  with  the  previous  three  steps, 
means  the  building  layout  should  be  based  on  the  following  criteria : 

Maximum  risk  separation. 

Containing  the  effects  of  an  explosion,  and 

Designing  each  room  to  the  risk  level  of  the  operations  carried  out  in  it. 

3.1.  Facility  general  layout 

The  facility  requires  4  kinds  of  workspaces  which  can  be  split  into  two  parts : 

a)  Explosive  Area 

Contiguous  cells  for  test  (1)  and  one  cell  for  storage  (2). 

A  corridor  (3)  for  transportation  of  explosive  charges  and  for  personnel  movement. 

b)  Facility  control  and  processing  section 

Several  rooms  needed  for  facility  control,  instrumentation  and  management  (4). 

This  arrangement  makes  it  feasible  to  easily  examine  the  impact  of  each  risk  donor 
(P.E.S.)  on  the  others,  considered  as  risk  receivers  (E.S.). 
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[T]  Test  cell  Ja]  Dally  storage  [3]  Corridor  [4]  Offices  area 


3.2.  Design  of  Explosive  Area  (P.E.S.) 


The  cells  in  the  explosive  area  are  composed  of  five  blast  resistant  walls  and  one  blow-out 
wall.  The  lateral  walls  extend  in  the  direction  of  a  barricade.  At  their  upper  parts  shield 
plates  are  bolted  for  arresting  fragments  or  channeling  them  towards  the  barricade  and 
damping  the  shock  wave.  A  heavy,  sliding,  electronically-controlled  door  enables  entry  to 
each  cell. 


The  corridor  is  composed  of  the  strong  walls  of  the  cells  and  a  strong  vertical  wall 
separating  the  explosive  area  from  the  inert  zone.  It  acts  as  an  airlock  between  the  inert 
zone  and  the  test  cells.  As  the  risk  level  in  the  corridor  is  low  the  roof  is  light  but  capable  of 
resisting  the  back-pressure  wave  coming  from  a  blow-out  wall  of  one  of  the  cells.  It  is 
equipped  with  meshing  to  protect  the  personnel  from  falling  roof  fragments. 


3.3  Design  of  the  control  and  processing  section  (  E.S.) 


This  part  of  the  building  adjoins  the  corridor.  Its  construction  is  designed  to  withstand  the 
effects  of  an  accident  produced  in  one  of  the  P.E.S.s  and  consequently  to  guarantee  the 
safety  of  personnel  in  this  area.  A  sliding  heavy  door  provides  access  to  the  corridor  which, 
in  turn,  provides  access  to  other  parts  of  the  building. 
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IV  Internal  safety  organization 


4.1  Safety  equipment 


Risk  management  requires  the  implementation  of  checking,  surveillance,  and  intervention 
devices,  such  as : 

-  A  communication  network  linking  all  facility  cells  to  the  control  center. 

-  A  video  camera  network  for  the  surveillance  of  all  cells  and  the  corridor. 

-  A  lighted  panel  signalling  system  indicating  the  status  of  each  cell  (explosive  or  inert 
activity). 

-  An  emergency  cut-off  switch  near  each  test  machine. 

-  Fire  protection  including  a  high  speed  deluge  system  and  conventionel  fire  fighting 
systems. 

-  Lightning  protection. 

-  grounding  of  all  conductive  elements. 

-  building  access  control  by  means  of  the  facility  manager's  control  board. 

The  facility  manager's  control  center  provides  the  following  capabilities  : 

-  control  of  the  closed  circuit  surveillance  system. 

-  control  of  auditory  signals  indicating  the  transfer  of  explosive  items. 

-  Control  of  lighted  panels  situated  above  the  heavy  doors. 

-  manual  control  of  the  deluge  system,  and 

-  building  access  control. 
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4.2  Operating  rules 

Operating  rules,  based  on  the  facility  characteristics  adopted  in  the  design  phase,  make  it 
possible  to  ensure  safety  by  determining  the  conditions  in  which  the  various  functions  will 
be  carried  out. 


In  an  environmental  test  facility  each  risk  donor  (P.E.S.)  should  contain  any  possible 

hazard ;  no  propagation  of  any  incident  can  be  allowed.The  heavy  doors  between  the  cells 

and  the  corridor  should  therefore  be  used  according  to  strict  procedures. 

-  When  not  in  use,  all  heavy  doors  remain  closed. 

-  Any  particular  door  can  be  opened  only  if  all  the  others  are  closed. 

-  Opening  a  cell  door  immediately  cuts-off  all  machinery  in  that  cell. 

-  Opening  a  cell  door  is  accomplished  through  electric  command  units  placed  in  the  corridor 
and  inside  the  cell.  If  necessary,  doors  can  be  opened  manually  from  the  corridor  and  from 
inside  the  cell. 

-  The  door  opening  unit  is  regulated  by  a  timer.  Automatic  closing  of  the  door  is  prevented 
in  case  an  obstacle  (either  a  person  or  an  object)  lies  in  its  path. 

-  Access  to  the  storage  cell  is  controlled  by  the  facility  manager,  and  is  only  possible  when 
the  test  cells  are  not  in  use. 

The  test  cells  can  be  used  in  two  modes  : 

Inert  mode  :  Personnel  may  be  inside  the  cell  for  adjustment,  control,  and  testing 

operations  involving  inert  materials. 
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Active  mode  :  Operators  may  be  present  during  the  installation  and  instrumentation 
phases  involving  test  equipment  ;  the  risk  level  at  thege  times  is  rated  at  P2.  During  the 
operation  of  test  machinery,  the  cell  is  strictly  off-limits  to  all  personnel,  as  the  risk  level 
here  reaches  P3. 

The  cell  mode  is  selected  on  the  control  panel  located  in  the  control  center  through  the  use  of 
a  key.  The  mode  selected  is  automatically  indicated  on  the  control  panel  as  well  as  on  the 
lighted  panel  above  the  cell  door. 


4.2.1  -  Activation  of  a  test  cell 


In  order  to  keep  the  test  procedure  under  control,  a  single  key  kept  in  the  test 
engineer's  possession  at  all  times  enables : 

The  cell  mode  (active  or  inert)  to  be  selected. 

The  activation  of  the  test  machine. 

In  "active  mode"  the  machine  can  only  be  switched  on  from  the  control  panel  located  in 
the  control  center  using  the  unique  key  kept  at  all  times  in  the  test  engineer's  possession. 
The  machine  is  stopped  in  the  same  way,  or  the  event  where  the  cell  door  is  opened. 

In  "inert  mode"  activating  the  test  equipment  requires  authorization  for  the  necessary 
electrical  power  from  the  test  engineer.  He  must  insert  his  key  into  a  lock  on  the  machine, 
then  convey  the  order  to  start-up  the  machine  by  intercom  to  an  operator  in  the  control 
center,  who  then  activates  the  equipment  by  pressing  a  button.  The  test  equipment  can  be 
stopped  either  from  the  control  center  or  by  use  of  the  emergency  cut-off  switch  located  near 
the  machine ;  opening  the  cell  door  automatically  shuts  down  the  test  equipment. 

When  the  machine  is  shut  down,  its  electrical  power  supply  is  desactivated.  This 
means  that  the  entire  sequence  must  be  rerun  for  the  next  startup. 
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4.2.2 -A  normal  operating  sequence 

a)  Transporting  material  for  the  test 

The  person  in  charge  of  the  test  collects  the  material  in  the  storage  cell  and 
contacts  the  control  room  by  intercom.  All  cells  are  alerted  by  intercom  and  by  an 
audible  signal,  of  the  imminent  material  transport.  All  cell  doors  are  closed  during 
this  operation. 

b)  Preparing  the  test 

The  material  is  removed  from  its  packing  and  put  in  place  on  the  test  machine 
with  the  specific  instrumentation. 

c)  The  test 

The  person  in  charge  of  the  test  returns  to  the  control  center,  places  his  key  in  the 
switch  and  begins  the  test  sequence.  At  the  end  of  the  test  sequence,  when  the  test 
equipment  has  been  switched  off,  the  test  engineer  removes  his  key  from  the 
control  panel,  returns  to  the  test  cell,  performs  the  necessary  verifications,  repacks 
the  material  and  returns  it  to  the  storage  cell  under  the  same  transport  conditions 
as  before. 


4.3  -  Analysis  of  personnel  risk  exposure 

Tests  of  explosive  charges  in  the  facility,  under  the  operating  rules  previously  cited,  must 
be  analysed  to  determine  if  the  level  of  residual  risks  to  which  personnel  are  exposed  is  acceptable. 
This  analysis  is  based  on  the  criteria  defined  earlier  :  Hazard  (Zi),  and  the  probability  of  an 
accidental  explosion  (Pj). 
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In  order  to  conduct  this  analysis  we  should  examine  4  types  of  situation  : 

material  storage  phase, 
material  transport  phase, 
the  test  preparation  phase, 
the  test  phase. 

In  each  of  these  cases,  the  most  significant  hazard  lies  in  the  accidental  explosion  of  the 

charge. 

4.3.1  Material  being  held  in  the  storage  cell 

A  maximum  of  four  charges  of  a  unitary  net  weight  inferior  or  equal  to  the  TNT 
equivalent  weight  allowed  by  the  cell's  explosion  resistance  rating  can  be  stored  in  the  cell. 
Steps  are  taken  to  prevent  more  than  one  charge  from  detonating  simultaneously. 

The  horizontal  and  vertical  walls  are  capable  of  withstanding  the  effects  of  an 
accidental  explosion,  with  the  door  between  the  cell  and  the  corridor  closed.  The  blow-out 
wall  allows  for  an  internal  overpressure,  and  the  shock  wave  would  be  directed  towards  the 
barricade. 

Personnel  in  all  other  parts  of  the  facility  would  be  entirely  protected. 

Operations  are  limited  to  simple  material  handling,  conducted  by  two  employees.  The 
maximum  risk  exposure  could  be  described  thus,  in  regulation  terms : 

-  P.E.S.  -  ao  -  2  persons  /  Hazard  zone  Z1  /  Probability  level  PI.  In  other  words,  a  major 
hazard,  but  with  an  extremely  low  probability. 

-  E.S.  -  ai  -  Other  cells  and  the  inert  zone  -  4  persons  /  Hazard  zone  Z3  /  Probability  level  PI. 
Here,  the  hazard  is  slight  and  the  probability  of  an  accident  extremely  low. 

No  other  person  or  installation  is  exposed  to  a  significant  risk  ;  the  situation  is 
acceptable. 
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4.3.2.  -  Material  transport  phase 

A  charge  is  transported  from  the  storage  cell  to  a  test  cell,  and  back,  in  its  packing  and 
under  conditions  that  make  it  possible  to  avoid  any  false  handling.  Only  one  door  can  be 
open  during  this  phase  :  either  the  door  of  the  test  cell  or  the  door  of  the  storage  cell,  and 
only  when  the  charge  is  being  moved  in  and  out  of  each  cell. 

All  personnel  informed  that  material  is  being  transported  are  either  in  a  cell  or  in  the 
inert  zone.  The  vertical  walls  of  the  corridor  would  direct  any  eventual  blast  effects  and 
projectiles  upward.  The  roofs  of  the  cells  and  the  inert  areas  are  calculated  to  withstand 
overpressures  and  to  support  any  eventual  projectile  fallback. 

The  maximum  risk  exposure  is  therefore : 

P.E.S.  -  ao  - 1  (or  2  person(s)  /  Hazard  zone  Z1  /  Probability  level  PI 

E.S.  -  aj  -  cells  and  inert  zone  -  5  persons  /  Hazard  zone  Z3  /  Probability  level  PI. 

No  other  person  or  installation  is  exposed  to  a  significant  risk  ;  the  situation  is 

acceptable. 


4.3.3.  -  Test  preparation  phase 

Test  preparation  operations  consist  of  placing  the  charge  on  the  test  machine  and 
installing  the  necessary  instrumentation  ;  the  charge  is  subjected  to  no  particular  stimuli, 
but  we  nonetheless  consider  the  probability  of  an  accident  higher  in  this  phase. 

In  the  event  of  an  accidental  explosion,  the  vertical  walls  and  heavy  door  would 
contain  the  blast  effects.  The  cell's  blow-out  wall  would  be  destroyed.  The  blast  wave  and 
projected  fragments  would  be  directed  along  the  extended  lateral  walls  and  fragment¬ 
shielding  plates  toward  the  barricade. 
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